CIMA BA3 Exam Prep
Fundamentals of Financial Accounting (Page 12 )

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• A — Can help keep costs down and improve quality: The provider may have specialist expertise, efficient systems and economies of scale.
• B — There is a known fee if agreed in advance: A fixed or agreed fee can make costs more predictable and support budgeting.
• C — Allows management to focus on core operations and issues: Senior managers spend less time supervising routine finance processes and more time on strategic matters.

• Increased control: Control may decrease because the activity is performed externally.
• Increased independence: The organisation becomes dependent on the supplier.
• Increased understanding of the outsourcing business: The internal organisation usually has greater business knowledge; the provider may initially lack it.
• Increased confidentiality: Sharing financial information externally may create confidentiality risks.
• Internal expertise improved: Outsourcing can reduce opportunities to develop internal finance skills.

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Date: 2018-12-31
• Time: 08:59

• B: The original value contains the text at, so it cannot be converted directly to a date.
• A: The last characters contain the time, not the date.
• D: Extracting the first 11 characters can leave an unwanted space and does not properly separate the time component.

• IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.
• SSL: Protects specific application sessions and has largely been replaced by TLS.
• SSH: Secures remote command-line administration.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• Open or insecure ports
• Enabled legacy or insecure protocols
• Known vulnerabilities and misconfigurations
• Weak services and outdated software

• curl tests web requests and HTTP-based services.
• Wireshark captures and analyzes network traffic; it does not normally scan servers for weaknesses.
• netcat can test connectivity to individual ports and sometimes grab service banners, but it is not a comprehensive vulnerability scanner.

• Mesh: WAPs communicate wirelessly with one another, often to extend coverage without wired connections. It does not specifically describe centralized WLC management.
• Point-to-point: Connects two specific devices or locations.
• Ad hoc: Wireless devices communicate directly with one another without an access point.

• Guiding principles
• Governance
• Service value chain
• Practices
• Continual improvement

• Guiding principles: Recommendations that guide decisions and actions; they do not describe the entire system.
• Four dimensions: Perspectives used to ensure a balanced approach to service management.
• Service relationship: Describes cooperation between a service provider and service consumer, rather than the whole value-creation system.

• A is correct: Days beyond the included period incur an extra daily charge.
• D is incorrect: Daily use after 10 days is not free.
• B and C: Data-transfer pricing can depend on the direction and service terms. The exam’s intended distinction is that the included device usage period is the clearly stated no-cost benefit.

• Writing with Apache Spark, typically as Delta tables.
• Reading with Apache Spark for processing and analysis.
• Reading with T-SQL through the lakehouse’s automatically generated SQL analytics endpoint.
• Reading with KQL through Fabric’s query capabilities that can access lakehouse data.

• Eventhouse: Optimized for real-time and KQL workloads, but it is not the natural destination for Spark-based writes or general lakehouse storage.
• Datamart: Intended mainly for relational analytics and Power BI; it is not designed for Spark-based data ingestion.
• Warehouse: Primarily T-SQL-based and structured. It does not provide the same native Spark write experience or flexibility for semi-structured data.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• tag=Priv searches the tag field for values beginning with Priv. The wildcard can match the remaining characters, so it matches Privileged.
• tag=Priv would search for the exact tag Priv, not Privileged.
• tag=priv* uses lowercase priv; tag matching is treated as case-sensitive here, so it may not match the tag Privileged.
• tag=privileged uses the wrong capitalization for the exact tag.

• Premium file shares: contoso104 only
• Blob access tiers: contoso101, contoso102, and contoso103

• Premium Azure Files shares require a storage account with the FileStorage account kind. This is a specialized account type and is not used for blob storage.
• Blob access tiers such as Hot, Cool, and—where supported—Archive apply to blob-capable accounts, such as General-purpose v2 or BlobStorage accounts shown in the exhibit.
• contoso104 is therefore excluded from the blob-tier selection because it is the premium Files account.

Why

cmd 
PowerShell.exe -ExecutionPolicy Bypass -File C:\Scripts\ConfigureVM.ps1

Why the other options are less suitable

• GPO logon script: Runs only when a user logs on and may not run during initial VM provisioning.
• GPO startup script: Can work, but requires the VM to be joined to the domain and the policy to be applied. It is also normally evaluated at each startup.
• Place scripts in a VHD: Merely placing scripts on a disk does not cause them to execute.

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• Import — Loads data into Power BI. It requires a refresh, so it may not reflect changes within two minutes unless refresh is configured appropriately.
• Live connection — Connects to an existing Power BI semantic model or Analysis Services model; it is not the normal choice for connecting directly to an Azure SQL database.

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

1. Modify the database subnet NACL inbound rules to allow traffic from the new web subnet’s CIDR block on the MySQL port (3306).
2. Modify the database subnet NACL outbound rules to allow return traffic to the new web subnet’s CIDR block on the required ephemeral port range.

• The policy is confidential, and the requester is no longer authorized merely because they used to work for the organization.
• The security professional should not disclose it by email or display it on a device without authorization.
• Using official channels allows the organization’s owner or information custodian to verify:

• Numerical flexibility: Adjusting the number of employees, such as using temporary, part-time or contract staff.
• Temporal flexibility: Varying when employees work, such as through flexitime, overtime or different working hours.
• Shift system flexibility: Changing work patterns or shift arrangements; it is not specifically about moving between tasks.

• Use one Azure AD directory for the organization.
• Separate divisions with subscriptions and/or resource groups.
• Assign each division’s administrator appropriate Azure role-based access control (RBAC) permissions, scoped to their subscription or resource group.

• Progress iteratively with feedback focuses on making improvements in manageable steps and learning from feedback.
• Optimize and automate focuses on maximizing value from resources and automating suitable activities.
• Start where you are focuses on assessing the current situation and reusing what already exists.

• ADF: Automatic Document Feeder; a printer/scanner hardware component.
• USB: A short-range wired connection, not a protocol for accessing a remote shared folder.
• PCL: Printer Control Language; it describes how print jobs are formatted, not how files or printers are shared over a network.

• administrators — Full access to switch configuration and REST API functions; excessive for this requirement.
• sysadmin — Intended for highly privileged system administration, not basic monitoring.
• helpdesk — More limited and focused on troubleshooting/support functions; it does not match the stated default role and level-1 requirement as directly.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• A. Configure prompt modifications to enforce tone, disclaimers, and refusal behavior at the system level.

• D. Configure Power Platform DLP policies to restrict unauthorized data connectors.

• B: Manual topic-by-topic disclaimer edits are specifically discouraged.
• C: Channel settings do not replace agent-level Responsible AI controls.
• E: Publishing before enabling safety filters violates the stated deployment sequence. Responsible AI filters should be enabled before publication, not afterward.

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

• A private IP address on the virtual network
• An associated public IP address

python 
def add_integers(a, b): 
    return a + b

• Uses def to define a function.
• Accepts two parameters, a and b.
• Uses return to send their sum back to the caller.
• Uses indentation to define the function body.

python 
result = add_integers(3, 4) 
result is 7

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.
• Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.
• Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• Developed and maintained independently
• Deployed without changing the entire application
• Scaled separately based on demand
• More resilient when another service has problems

• A: Functional testing is useful, but it is not the main practice described.
• B: Automation helps deployment, but the scenario focuses on architectural decomposition.
• C: Multiple locations improve availability, not application modularity.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• Modelo de embeddings de texto: trabalha principalmente com texto, não sendo adequado para imagens.
• Modelo generativo multimodal: pode interpretar ou gerar conteúdo de vários tipos, mas não é a opção específica para busca por similaridade.
• Modelo de geração de imagens: cria imagens a partir de entradas, não realiza busca multimodal.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

• A: Using an external OAuth 2.0 identity provider could provide unified identity, but it does not specifically address Salesforce capacity or high-volume login limits.
• B: Making the Experience Cloud community a SAML identity provider and using JIT provisioning is a possible federation pattern, but it may not be appropriate for this scale without Salesforce validation.
• C: A default account is unrelated to solving identity unification and high login throughput. Person Accounts can be supported in appropriate B2C Commerce integrations.

• A. Tuning system software: This is a corrective action, not an analysis method. Tuning should be based on measured performance data.
• B. User dissatisfaction reports: Useful as an indicator, but subjective and insufficient for diagnosing the cause.
• D. Off-peak utilization and response time: This may hide problems occurring during peak periods. Performance analysis should cover representative or peak workloads.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• Input feature distributions differ from training data ? Analyze dataset drift metrics

• Model accuracy drops without code changes ? Analyze dataset drift metrics

• Endpoint latency increases under load ? Investigate scaling and infrastructure metrics